CVE-2009-4769

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b,...

9.3 HighPublic exploit

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b, and 1.5 allow (1) remote attackers to execute arbitrary code via format string specifiers in a GET request to the HTTP server component when logging is enabled, and allow (2) remote authenticated users to execute arbitrary code via format string specifiers in a PWD command to the FTP server component.

Exploit likelihood

37.9%Down 41.8 points since Feb 4, 2022

What each source reports

NVD Score used 9.3

Record: CVE-2009-4769
CVSS 2.0: 9.3 HighAV:N/AC:M/Au:N/C:C/I:C/A:C
Weakness: CWE-134
Updated: 2026-11-02

CVE List No score

Record: CVE-2009-4769
Updated: 2026-11-02

EUVDEUVD-2009-4732 No score

Record: EUVD-2009-4732
Updated: 2026-11-03

GitHub AdvisoriesGHSA-72h8-x8gh-6pw7 No score

Multiple format string vulnerabilities in the tolog function in httpdx 1.4, 1.4.5, 1.4.6, 1.4.6b,...

Record: GHSA-72h8-x8gh-6pw7
Weakness: CWE-134
Updated: 2026-11-02

Affected products

jasper httpdx

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	httpdx - 'tolog()' Format String (Metasploit) (1)	2010-08-25
Exploit-DB	httpdx - 'tolog()' Format String (Metasploit) (2)	2010-08-25
Metasploit	HTTPDX tolog() Function Format String Vulnerability	2009-11-17
Metasploit	HTTPDX tolog() Function Format String Vulnerability	2009-11-17

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2009-4769 is a high vulnerability (CVSS 9.3) in Jasper Httpdx, published April 20, 2010. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 37.9%, the 98th percentile. No source names a fixed version.